NEN 7510 explained: who must comply, what the Dutch healthcare inspectorate expects and what changed in 2024

NEN 7510 is the Dutch standard for information security in healthcare and the only standard that Dutch healthcare legislation refers to directly. A new edition that follows the structure of ISO 27001:2022 has been in force since 16 December 2024, and the transition period for existing certificates ends on 20 February 2027. This article describes what the two parts of the standard contain, which organisations must comply and on what legal basis, what the Health and Youth Care Inspectorate (IGJ) means by demonstrable compliance, what changed in 2024, how certification under the NCS 7510 scheme works and where healthcare organisations and their suppliers get stuck in practice.

Two parts, and the supplementary standards 7512 and 7513

NEN 7510 consists of two parts. NEN 7510-1 contains the requirements for the information security management system and follows the text of ISO 27001: clauses 4 to 10 on context, leadership, planning, support, operation, performance evaluation and improvement, plus Annex A with the controls. That is the part against which organisations are certified and on which an auditor raises nonconformities. NEN 7510-2 is the implementation guidance: the Dutch rendering of ISO 27002, combined with the healthcare-specific controls from ISO 27799. Anyone who knows ISO 27001 will recognise the structure immediately. The difference lies in the healthcare-specific layer and in the status of that guidance, which is covered below.

Two further standards sit underneath it. NEN 7512:2022 covers the basis of trust for data exchange: the assurances parties must give each other before they exchange patient data electronically, with five levels of requirements for availability, integrity and confidentiality. NEN 7513:2024 covers logging, the recording of actions on personal health information, and is based on the international standard ISO 27789 for audit trails of electronic health records. Both standards elaborate specific requirements of NEN 7510. You cannot be certified against them separately.

All three standards can be consulted free of charge through NEN Connect under an agreement between the Ministry of Health, Welfare and Sport and NEN. There is no English edition; the international counterparts ISO 27001, ISO 27002, ISO 27799 and ISO 27789 are available in English.

Who must comply, and where that is written

The obligation is not in NEN 7510 itself but in the Decree on electronic data processing by healthcare providers, an order in council under the Act on additional provisions for the processing of personal data in healthcare (Wabvpz), in force since 1 January 2018. Article 3 requires a healthcare provider to ensure the safe and careful use of its healthcare information system, and of the electronic exchange system it is connected to, in accordance with NEN 7510 and NEN 7512. The same requirement applies to the party responsible for such an exchange system. Article 5 requires the logging of both kinds of system to comply with NEN 7513. Article 4 requires policies and procedures to use the terms and definitions of the standards, and article 6 requires the organisation to keep up with the state of the art and account for how it applies it.

The Decree does not name a year for the standards. Article 7 states that the latest edition always applies and that the Minister of Health announces in the Government Gazette (Staatscourant) from which date a new edition applies, if necessary with different dates for existing and new systems. That is the legal route; the practical deadline comes from the certification scheme and is described further down.

The target group is wider than hospitals and general practitioners. NEN describes it as every organisation that processes personal health information, regardless of its nature and size. That includes municipalities that process medical data for social support and youth care, and suppliers that host, manage or exchange healthcare data through interfaces. For a legal entity that is not a healthcare provider but operates an electronic exchange system, the Decree goes a step further: an independent organisation must have established, after an investigation, that the entity and the system comply with NEN 7510 and NEN 7512, in an audit report no more than five years old. Youth care providers are an exception: the IGJ refers them to ISO 27001 under the Youth Act.

Two misunderstandings keep coming back. The first is that a small practice falls outside the standard; it does not, the requirement makes no distinction by size. The second is that software or a browser can be NEN 7510 compliant. The standard addresses organisations, not products. The healthcare provider sets requirements for its supplier, and the supplier demonstrates through specifications and evidence that it meets them.

What the IGJ means by demonstrable compliance

Two regulators are involved. The Dutch Data Protection Authority approaches the standard from the protection of personal data and focuses on confidentiality and integrity. The IGJ treats information security as a precondition for the continuity and quality of care: a ransomware attack or a power failure affects patient safety directly. In 2025 both regulators opened an investigation into the same hacked laboratory, which shows that the two roles operate side by side in practice.

The IGJ expects a healthcare provider to demonstrably operate an information security management system that meets NEN 7510, with a continuity plan that is tested regularly, and to have the management system and the Annex A controls assessed regularly by an independent and competent auditor. Independent here means someone with knowledge of the standard, of auditing a management system and of healthcare, who is not involved in the policy and its implementation. That can be an internal auditor, an external specialist or an employee of another healthcare organisation. A certificate is one way to show this; the IGJ does not require one.

Demonstrable means in practice that the control works and not merely exists. An information security policy with the right title is not evidence; a log file, an incident register, a tested continuity plan and an interview with the employee who performs the control are. How to organise that evidence is described in the article on audit evidence. Note the boundary with the GDPR as well: NEN 7510 covers part of the GDPR requirements, not all of them. A record of processing activities or a DPIA does not come out of the standard.

NEN 7510:2024: what changed

The revised parts 1 and 2 were published on 16 December 2024. The trigger was the revision of ISO 27001 and ISO 27002 in 2022. Part 1 therefore follows the harmonised structure of ISO 27001:2022, and Annex A has been regrouped into the four themes organisational, people, physical and technological, with 93 controls instead of 114 and with purposes and attributes for each control. The mapping figures and the eleven new controls from that ISO revision are described in the article on ISO 27001:2022; they apply one to one to NEN 7510. The 2024 climate amendment has been included as well: the organisation must determine in its context analysis whether climate change is a relevant issue.

On top of the 93 general controls, NEN 7510-2:2024 has eight healthcare-specific controls, and fourteen general controls carry a healthcare-specific addition. Some of these anticipate NIS2: emergency communication (5.42), external incident reporting (5.43), management training (6.9) and zero trust (8.35). Annex E of part 2 contains a mapping of the standard to the NIS2 requirements, which is useful for healthcare providers that fall under the Dutch Cybersecurity Act; the IGJ is the supervisory authority for the healthcare sector under that act. Providers outside its scope remain bound by NEN 7510 regardless.

The change with the biggest consequences for the audit is the status of the implementation guidance. In the 2017 edition, part 2 was non-binding. Since 2024, comply or explain applies: if you include a control in the Statement of Applicability but deviate from the healthcare-specific guidance, you record how you still achieve the purpose of that control. An auditor may ask for that record. Nonconformities are only raised against the requirements of part 1 (clauses 4 to 10 and Annex A), but a Statement of Applicability copied from an ISO 27001 project that ignores the healthcare-specific guidance will not get through stage 1 unscathed.

The transition period and how certification works

NEN does not certify. NEN manages the certification scheme NCS 7510 and licenses certification bodies, which must be accredited for this scheme by the Dutch Accreditation Council (RvA). The scheme sets out how the certification process runs, which competences the auditors need and how the number of audit days is calculated. Certification is against NEN 7510-1. The organisation sets its own scope, but the primary care processes of the unit concerned must be inside it. An organisation that also processes other information and therefore needs ISO 27001 as well does not, under the scheme, have to undergo the same audit twice. Which of the two you need, and when both, is covered in ISO 27001 versus NEN 7510.

The revised scheme NCS 7510:2025 was published on 20 February 2025. From that date, certification bodies could apply to the Dutch Accreditation Council for a scope extension; without it they may not issue certificates against NEN 7510:2024. Existing certificate holders were given two years: by 20 February 2027 every certificate must have been converted. Anyone starting a first certification now does so directly against the 2024 edition. The process itself runs as it does for ISO 27001, with a stage 1 on documentation and readiness, a stage 2 on operating effectiveness, and then a three-year cycle with surveillance audits. That process is described step by step in the ISO 27001 certification roadmap.

Whoever advised the organisation on the implementation cannot also certify it. That independence principle applies under accreditation to every certification body. An adviser or internal auditor therefore delivers readiness; the certificate comes from an accredited body. How we guide healthcare organisations to that point is described on our compliance services page.

Where it goes wrong in practice

The first pattern is logging without review. NEN 7513 and article 5 of the Decree require access to the record to be logged, and most healthcare information systems do that. What is missing is the second half: someone who periodically reviews the logging for legitimacy, a procedure for handling unauthorised access, and a way of working for the patient who, under the Wabvpz, asks who has had access to their data. An auditor asks first for that review and its follow-up, and only then for the log file.

The second pattern is a scope that stops at the electronic health record. Healthcare data also lives in home care apps, in networked medical devices, in the mailbox of the front desk and with the supplier that manages the backups. A risk assessment that only covers the record system misses the places where incidents actually arise.

The third pattern concerns suppliers. A data processing agreement is a contract, not a control, and a supplier's ISO 27001 certificate only says something if the scope on that certificate covers the service and the healthcare data. Anyone assessing a supplier reads the scope statement, the Statement of Applicability and the most recent audit report, and records which healthcare-specific controls sit with the supplier. How to set that up structurally is described in the article on third party risk management.

The fourth pattern is the Statement of Applicability taken from an ISO 27001 template. The 93 controls are in it, the eight healthcare-specific controls and the fourteen additions are not, and where the organisation deviates from the healthcare-specific guidance the explanation is missing. Under comply or explain that is exactly the document an auditor looks at first. Anyone commissioning a gap analysis for the transition to the 2024 edition should have it start with part 2, not part 1.

Sources: Decree on electronic data processing by healthcare providers (Staatsblad 2017, 446, consolidated text on wetten.overheid.nl), NEN, Information security in healthcare (frequently asked questions on NEN 7510:2024, NCS 7510:2025 and the transition period), IGJ, Questions about NEN 7510.